|
| 1 | +from virttest import data_dir, env_process, error_context |
| 2 | + |
| 3 | + |
| 4 | +@error_context.context_aware |
| 5 | +def run(test, params, env): |
| 6 | + """ |
| 7 | + Please make sure the guest installed with signed driver |
| 8 | + Verify Secure MOR control feature using Device Guard tool in Windows guest: |
| 9 | +
|
| 10 | + 1) Boot up a guest. |
| 11 | + 2) Check if Secure Boot is enable. |
| 12 | + 3) Download DG_Readiness_Tool and copy to guest. |
| 13 | + 4) Enable Device Guard and check the output. |
| 14 | + 5) Reboot guest. |
| 15 | + 6) Check the result of Device Guard. |
| 16 | + 7) Disable Device Guard and shutdown guest. |
| 17 | +
|
| 18 | + :param test: QEMU test object |
| 19 | + :param params: Dictionary with the test parameters |
| 20 | + :param env: Dictionary with test environment. |
| 21 | + """ |
| 22 | + |
| 23 | + def set_powershell_execute_policy(): |
| 24 | + """ |
| 25 | + Set PowerShell execution policy using the provided session. |
| 26 | + It is used when creating a new session. |
| 27 | +
|
| 28 | + :param cmd: The PowerShell command to set execution policy. |
| 29 | + """ |
| 30 | + error_context.context("Setting PowerShell execution policy.") |
| 31 | + status, output = session.cmd_status_output(executionPolicy_command) |
| 32 | + if status != 0: |
| 33 | + test.fail("Failed to set PowerShell execution policy: %s" % output) |
| 34 | + |
| 35 | + def check_secure_boot_enabled(): |
| 36 | + """ |
| 37 | + Checks if Secure Boot is enabled in the guest. |
| 38 | + """ |
| 39 | + error_context.context("Checking if Secure Boot is enabled in the guest") |
| 40 | + output = session.cmd_output(check_cmd) |
| 41 | + if "false" in output.lower(): |
| 42 | + test.fail("Secure Boot is not enabled: %s" % output) |
| 43 | + |
| 44 | + def copy_dg_readiness_tool(): |
| 45 | + """ |
| 46 | + Copies the Device Guard Readiness tool from the host to the guest VM. |
| 47 | + """ |
| 48 | + dgreadiness_host_path = data_dir.get_deps_dir("dgreadiness") |
| 49 | + dst_path = params["dst_path"] |
| 50 | + test.log.info("Copy Device Guard tool to guest.") |
| 51 | + s, o = session.cmd_status_output("mkdir %s" % dst_path) |
| 52 | + if s and "already exists" not in o: |
| 53 | + test.error( |
| 54 | + "Could not create Device Guard directory in " |
| 55 | + "VM '%s', detail: '%s'" % (vm.name, o) |
| 56 | + ) |
| 57 | + vm.copy_files_to(dgreadiness_host_path, dst_path) |
| 58 | + |
| 59 | + def check_vbs_ready(): |
| 60 | + """ |
| 61 | + Check the status of Virtualization-Based Security (VBS) using the provided |
| 62 | + session. |
| 63 | +
|
| 64 | + :return: True if VBS is enabled, False otherwise. |
| 65 | + """ |
| 66 | + status, output = session.cmd_status_output(ready_command) |
| 67 | + if status != 0: |
| 68 | + test.fail("Failed to check VBS status: %s" % output) |
| 69 | + if vbs_ready_info in output: |
| 70 | + test.log.info("VBS is already enabled, and guest boot up successfully") |
| 71 | + return True |
| 72 | + else: |
| 73 | + test.log.info( |
| 74 | + "VBS is not enabled or the expected info was not found in the output" |
| 75 | + ) |
| 76 | + return False |
| 77 | + |
| 78 | + def run_device_guard_tool(cmd, expect_info): |
| 79 | + """ |
| 80 | + Executes the Device Guard Readiness Tool command in the guest to enable |
| 81 | + or disable Virtualization-Based Security (VBS). |
| 82 | +
|
| 83 | + :param cmd: The command to enable or disable VBS. |
| 84 | + """ |
| 85 | + error_context.context("running device guard readiness tool with %s" % cmd) |
| 86 | + output = session.cmd_output(cmd, 360) |
| 87 | + if expect_info not in output: |
| 88 | + test.fail("Failed to enable VBS: %s" % output) |
| 89 | + |
| 90 | + login_timeout = int(params.get("login_timeout", 360)) |
| 91 | + params["ovmf_vars_filename"] = "OVMF_VARS.secboot.fd" |
| 92 | + params["clone_master"] = "yes" |
| 93 | + params["master_images_clone"] = "image1" |
| 94 | + params["remove_image_image1"] = "yes" |
| 95 | + params["start_vm"] = "yes" |
| 96 | + env_process.preprocess_vm(test, params, env, params["main_vm"]) |
| 97 | + vm = env.get_vm(params["main_vm"]) |
| 98 | + session = vm.wait_for_serial_login(timeout=login_timeout) |
| 99 | + |
| 100 | + check_cmd = params["check_secure_boot_enabled_cmd"] |
| 101 | + dgreadiness_path_command = params["dgreadiness_path_cmd"] |
| 102 | + executionPolicy_command = params["set_ps_policy_cmd"] |
| 103 | + enable_command = params["vbs_enable_cmd"] |
| 104 | + disable_command = params["vbs_disable_cmd"] |
| 105 | + ready_command = params["vbs_ready_cmd"] |
| 106 | + vbs_ready_info = params["vbs_ready_info"] |
| 107 | + vbs_enable_info = params["vbs_enable_info"] |
| 108 | + vbs_disable_info = params["vbs_disable_info"] |
| 109 | + |
| 110 | + try: |
| 111 | + check_secure_boot_enabled() |
| 112 | + copy_dg_readiness_tool() |
| 113 | + set_powershell_execute_policy() |
| 114 | + session.cmd(dgreadiness_path_command) |
| 115 | + if not check_vbs_ready(): |
| 116 | + run_device_guard_tool(enable_command, vbs_enable_info) |
| 117 | + vm.reboot(timeout=login_timeout) |
| 118 | + session = vm.wait_for_serial_login(timeout=login_timeout) |
| 119 | + session.cmd(dgreadiness_path_command) |
| 120 | + set_powershell_execute_policy() |
| 121 | + if not check_vbs_ready(): |
| 122 | + test.fail("VBS is not enabled after reboot.") |
| 123 | + test.log.info("------------disable -------------") |
| 124 | + run_device_guard_tool(disable_command, vbs_disable_info) |
| 125 | + except Exception as e: |
| 126 | + test.fail(f"Test failed: {e}") |
| 127 | + else: |
| 128 | + test.log.info("Test completed successfully.") |
| 129 | + finally: |
| 130 | + if vm.is_alive(): |
| 131 | + vm.destroy() |
| 132 | + if session: |
| 133 | + session.close() |
0 commit comments